Cybersecurity start-ups are proliferating, but sorting out what works and what doesn't is tricky